w3c / w3c/ServiceWorker

"no-cors" CSS SOP violation

Open
#719 73 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

apr-2017-f2f-v1 TPAC2025
Dominant language
Bikeshed
Stars
3.6k
Forks
324
Avg merge
14d 22h
Merged PRs (30d)
1

Description

Per our current set of definitions a service worker reveals what resources a "no-cors" CSS stylesheet attached to a document loads. In particular this can leak confidential tokens in the URLs.

Entered the public record here: http://krijnhoetmer.nl/irc-logs/whatwg/20150703#l-286

According to @jakearchibald resource timing (paging @igrigorik) did this first, in both Chrome and Firefox.

I think we should revert both, seems like bad precedent to cut more holes in SOP.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reading the issue and the linked WHATWG IRC log, then examine the service worker and resource timing behavior described for "no-cors" CSS stylesheets. Determine whether both exposures should be reverted; done means reaching and documenting a decision on the SOP and confidential-URL implications.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
security, web-dev
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.